Membuat transfer dengan Google Cloud console hanya melindungi konten file. Metadata file, seperti nama file dan ukuran file, tidak dilindungi.
Panduan ini menjelaskan penyiapan yang diperlukan untuk menggunakan Storage Transfer Service guna mentransfer ke bucket Cloud Storage dalam perimeter keamanan.
Untuk menggunakan Storage Transfer Service dengan Kontrol Layanan VPC, item berikut harus berada dalam perimeter layanan yang sama:
Project yang digunakan untuk membuat tugas transfer lokal
Bucket Cloud Storage tujuan.
Konfigurasi yang didukung
Gunakan salah satu metode berikut untuk mengonfigurasi agen transfer agar dapat
berfungsi dengan Kontrol Layanan VPC:
Jika agen transfer harus tetap berada di luar perimeter layanan yang berisi bucket Cloud Storage dan project Storage Transfer Service Anda, tambahkan agen ke tingkat akses.
Metode ini lebih mudah disiapkan, dan memungkinkan agen transfer mengakses
resourceGoogle Cloud di dalam dan di luar perimeter layanan.
Jika agen transfer dapat ditambahkan ke perimeter layanan yang berisi
bucket Cloud Storage dan project Storage Transfer Service,
konfigurasi Akses Google Pribadi dengan Kontrol Layanan VPC
untuk jaringan lokal yang digunakan oleh agen transfer.
Metode ini memerlukan lebih banyak langkah untuk diselesaikan, dan agen transfer
hanya dapat mengakses resource Google Cloud dalam perimeter
layanan.
Menambahkan agen ke tingkat akses
Untuk menambahkan agen transfer ke tingkat akses:
Tentukan cara Anda akan menambahkan agen ke tingkat akses: menurut alamat IP atau menurut akun layanan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[],[],null,["# Configure VPC Service Controls for file system transfers\n\nStorage Transfer Service supports on-premises transfers to Cloud Storage\nbuckets protected by VPC Service Controls, under the following conditions:\n\n- Creating a transfer with\n [Storage Transfer Service API](/storage-transfer/docs/reference/rest) protects all\n transferred data.\n\n- Creating a transfer with Google Cloud console protects only file contents. File\n metadata, such as file names and file sizes, are not protected.\n\nThis guide describes the setup required to use Storage Transfer Service to transfer to\nCloud Storage buckets within security perimeters.\n\nTo learn more about VPC Service Controls, see\n[Overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nFor information about using VPC Service Controls with Storage Transfer Service, see\n[Using Storage Transfer Service with VPC Service Controls](/storage-transfer/docs/transfer-with-vpc-sc).\n\nPrerequisites\n-------------\n\nTo use Storage Transfer Service with VPC Service Controls, the following items need\nto be located within the same service perimeter:\n\n- The project used to create on-premises transfer jobs\n- The destination Cloud Storage bucket.\n\nSupported configurations\n------------------------\n\nUse either of the following methods to configure transfer agents to\nwork with VPC Service Controls:\n\n- If transfer agents must remain outside of the service perimeter that\n contains your Cloud Storage bucket and Storage Transfer Service project,\n [add the agents to an access level](#adding-agents-to-access-level).\n\n This method is easier to set up, and allows transfer agents to access\n Google Cloud resources inside and outside the service perimeter.\n | **Important:** This option does not prevent transfers to buckets outside of the service perimeter. If you are concerned about transfers from on-premises to Cloud Storage buckets outside of the service perimeter, you need to [configure Private Google Access with VPC Service Controls](#private-access-with-vpc-sc) to prevent agents from accessing buckets outside of the service perimeter.\n- If transfer agents can be added to the service perimeter that contains\n your Cloud Storage bucket and Storage Transfer Service project,\n [configure Private Google Access with VPC Service Controls](#private-access-with-vpc-sc)\n for the on-premises network used by transfer agents.\n\n This method requires more steps to complete, and transfer agents are\n able to access only the Google Cloud resources within the service\n perimeter.\n\n### Adding agents to an access level\n\nTo add transfer agents to an access level:\n\n1. Determine how you will add agents to an\n [access level](/vpc-service-controls/docs/use-access-levels): by IP address\n or by service accounts.\n\n2. Add the agents to an access level:\n\n - To add agents' IP addresses to an access level, follow the instructions\n in\n [Limit access on a corporate network](/access-context-manager/docs/create-basic-access-level#corporate-network-example).\n\n - To add agents' service account to an access level, follow the\n instructions in\n [Limit access by user or service account](/access-context-manager/docs/create-basic-access-level#members-example).\n\n### Using Private Google Access with VPC Service Controls\n\nTo use Private Google Access with VPC Service Controls:\n\n1. [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters#creating_a_service_perimeter)\n to restrict the following services:\n\n - Cloud Storage\n - Storage Transfer Service\n2. [Configure Private Google Access for on-premises hosts](/vpc/docs/configure-private-google-access-hybrid).\n\n3. [Create transfer jobs](/storage-transfer/docs/managing-on-prem-jobs#create-transfer) in a project\n that is within the service perimeter.\n\n### Troubleshooting\n\nTo troubleshoot errors, see\n[Troubleshooting VPC Service Controls errors](/storage-transfer/docs/troubleshooting-on-prem#vpcsc)."]]
